ANS-C01 practice questions 181–190

1. Question 181 · 294 in bank

   A company runs a workload in a single VPC on AWS. The company’s architecture contains several interface VPC endpoints for AWS services, including Amazon CloudWatch Logs and AWS Key Management Service (AWS KMS). The endpoints are configured to use a shared security group. The security group is not used for any other workloads or resources. After a security review of the environment, the company determined that the shared security group is more permissive than necessary. The company wants to make the rules associated with the security group more restrictive. The changes to the security group rules must not prevent the resources in the VPC from using AWS services through interface VPC endpoints. The changes must prevent unnecessary access. The security group currently uses the following rules: • Inbound - Rule 1 Protocol: TCP - Port: 443 - Source: 0.0.0.0/0 - • Inbound - Rule 2 Protocol: TCP - Port: 443 - Source: VPC CIDR - • Outbound - Rule 1 Protocol: All - Port: All - Destination: 0.0.0.0/0 - Which rule or rules should the company remove to meet with these requirements?

   • AOutbound - Rule 2
   • BInbound - Rule 1 and Outbound - Rule 1
   • CInbound - Rule 2 and Outbound - Rule 1
   • DOutbound - Rule 1

   Show answer

   Answer: B

   Explanation

   Keep Inbound Rule 2 (VPC CIDR) so that only resources in the VPC can connect to the endpoints. Replace the removed outbound rule with a more restrictive rule that allows outbound traffic only to the AWS service VPC endpoints.

   Source: Adapted from community discussion — woorkim

   Next question

2. Question 182 · 294 in bank

   A company uses transit gateways to route traffic between the company's VPCs. Each transit gateway has a single route table. Each route table contains attachments and routes for the VPCs that are in the same AWS Region as the transit gateway. The route tables in each VPC also contain routes to all the other VPC CIDR ranges that are available through the transit gateways. Some VPCs route to local NAT gateways. The company plans to add many new VPCs soon. A network engineer needs a solution to add new VPC CIDR ranges to the route tables in each VPC. Which solution will meet these requirements in the MOST operationally efficient way?

   • ACreate a new customer-managed prefix list. Add all VPC CIDR ranges to the new prefix list. Update the route tables in each VPC to use the new prefix list ID as the destination and the appropriate transit gateway ID as the target.
   • BTurn on default route table propagation for the transit gateway route tables. Turn on route propagation for each route table in each VPC.
   • CUpdate the route tables in each VPC to use 0.0.0.010 as the destination and the appropriate transit gateway ID as the target.
   • DTurn on default route table association for the transit gateway route tables. Turn on route propagation for each route table in each VPC.

   Show answer

   Answer: A

   References

   • AWS documentation

   Next question

3. Question 183 · 294 in bank

   A company has several AWS Site-to-Site VPN connections between an on-premises customer gateway and a transit gateway. The company's application uses IPv4 to communicate through the VPN connections. The company has updated the VPC to be dual stack and wants to transition to using IPv6-only for new workloads. When the company tries to communicate through the existing VPN connections, IPv6 traffic fails. Which solution will provide IPv6 support with the LEAST operational overhead?

   • ACreate a new Site-to-Site VPN connection that supports IPv6.
   • BCreate a new Site-to-Site VPN connection to a self-managed Amazon EC2 instance that runs open source software.
   • CUpdate the existing Site-to-Site VPN connections to support IPv6.
   • DUpdate the on-premises customer gateway's public IP address from IPv4 to IPv6.

   Show answer

   Answer: A

   Next question

4. Question 184 · 294 in bank

   A company has two teams: Team A and Team B. Team A has VPCs that run in Account A. The team uses a transit gateway (TGW-A) to route traffic between workloads that run in the different VPCs. Similarly, Team В has VPCs that run in Account B. Team В uses a different transit gateway (TGW-B) to route traffic between workloads that run in the different VPCs. The company's network team manages the routing for Team A and Team В. The network team wants to retire TGW-B and use a single transit gateway to manage routing for the VPCs of both teams. Which solution will meet this requirement with the LEAST operational overhead?

   • ACreate a resource share for TGW-A Share TGW-A with Account B. Create VPC attachments for the VPCs in Account В. Configure routing for the VPCs in TGW-A route tables. Update the route tables of the VPCs in Account В to forward traffic to TGW-Delete TGW-B attachments and TGW-B.
   • BCreate a resource share for TGW-A. Share TGW-A with Account В. Replicate the TGW-B configuration to TGW-A to automatically start routing changes for the VPCs in Account В. Delete TGW-B when routing changes are complete.
   • CCreate a new transit gateway (TGW-C) in Account A. Create a resource share for TGW-Share TGW-C with Account B. Create VPC attachments for the VPCs in Account A and Account В. Configure routing for all the VPCs in TGW-C route tables. Update the route tables for the VPCs in Account A and Account В to forward traffic to TGW-Delete TGW-A attachments and TGW-B attachments. Delete TGW-A and TGW-B.
   • DCreate a new transit gateway (TGW-C) in a new account (Account C). Create a resource share for TGW-C. Share TGW-C with Account A and Account B. Create VPC attachments for the VPCs in Account A and Account В. Configure routing for all the VPCs in TGW-C route tables. Update the route tables for the VPCs in Account A and Account В to forward traffic to TGW-C. Delete TGW-A attachments and TGW-B attachments. Delete TGW-A and TGW-B.

   Show answer

   Answer: A

   Next question

5. Question 185 · 294 in bank

   Select 2

   A company has an AWS environment that includes multiple VPCs that are connected by a transit gateway. The company wants to use a certificate-based AWS Site-to-Site VPN connection to establish connectivity between an on-premises environment and the AWS environment. The company does not have a static public IP address for the on-premises environment. Which combination of steps should the company take to establish VPN connectivity between the transit gateway and the on-premises environment? (Choose two.)

   • ACreate a public certificate in AWS Certificate Manager (ACM).
   • BCreate a private certificate in AWS Certificate Manager (ACM).
   • CConfigure the Site-to-Site VPN tunnels to use the pre-shared key (PSK).
   • DCreate a customer gateway. Specify the current dynamic IP address of the customer gateway device's external interface.
   • ECreate a customer gateway. Do not specify the IP address of the customer gateway device.

   Show answer

   Answer: BE

   Explanation

   Why B (Create a private certificate in ACM) is correct: • AWS requires a private certificate from AWS Certificate Manager (ACM) for certificate-based authentication. • The certificate is used to authenticate the VPN connection instead of a pre-shared key (PSK). Why E (Create a customer gateway without specifying an IP address) is correct: • If the on-premises IP address is dynamic, you must create a customer gateway without an IP address. • This allows the VPN to function with BGP (Border Gateway Protocol), which dynamically updates the connection when the on-premises IP changes.

   Source: Adapted from community discussion — ashk123456

   Next question

6. Question 186 · 294 in bank

   A company operates in multiple AWS Regions. The company has deployed transit gateways in each Region. The company uses AWS Organizations to operate multiple AWS accounts in one organization. The company needs to capture all VPC flow log data when a new VPC is created. The company needs to send flow logs to a specific Amazon S3 bucket. Which solution will meet these requirements with the LEAST administrative effort?

   • AUpdate IAM permissions for each user to include a condition that ensures users can create VPCs only when VPC Flow Logs is enabled and configured correctly.
   • BCreate a custom AWS Config rule with automatic remediation that verifies VPC Flow Logs is enabled and configured correctly. Apply the AWS Config rule to the organization.
   • CEnable VPC Flow Logs on each transit gateway. Configure VPC Flow Logs to send flow logs to the specified S3 bucket.
   • DDeploy a serverless application that uses AWS CloudTrail to monitor for VPC creation events in each account. Configure the application to apply the correct VPC Flow Logs configuration.

   Show answer

   Answer: B

   Next question

7. Question 187 · 294 in bank

   A company wants to analyze TCP internet traffic. The traffic originates from Amazon EC2 instances in the company’s VPC. The EC2 instances initiate connections through a NAT gateway. The company wants to capture data about the traffic including source and destination IP addresses ports, and the first 8 bytes of the TCP segments of the traffic. The company needs to collect, store, and analyze all the required data points. Which solution will meet these requirements?

   • AConfigure the EC2 instances to be VPC traffic mirror sources. Deploy software on the traffic mirror target to forward the data to Amazon CloudWatch Logs. Analyze the data by using CloudWatch Logs Insights
   • BConfigure the NAT gateway to be a VPC traffic mirror source. Deploy software on the traffic mirror target to forward the data to an Amazon S3 bucket. Analyze the data by using Amazon Athena.
   • CTurn on VPC Flow Logs for the EC2 instances. Specify the default format and set Amazon CloudWatch Logs as the log destination. Analyze the flow log data by using CloudWatch Logs Insights.
   • DTurn on VPC Flow Logs for the EC2 instances. Specify a custom format and set Amazon S3 as the log destination. Analyze the flow log data by using Amazon Athena.

   Show answer

   Answer: B

   Next question

8. Question 188 · 294 in bank

   A media company is planning to host an event that the company will live stream to users. The company wants to use Amazon CloudFront. A network engineer creates a primary origin and a secondary origin for CloudFront. The engineer needs to ensure that the primary origin can fail over to the secondary origin within 15 seconds if a disruption occurs. Which solution will meet this requirement with the LEAST operational overhead?

   • AConfigure a Lambda@Edge function to check the health status of both origins every 10 seconds. Reroute incoming requests when the origin health status is unhealthy.
   • BCreate a Network Load Balancer (NLB) in front of both origins Configure the NLB as the origin in CloudFront.
   • CSet the CloudFront origin connection timeout value to 5 seconds Set the origin connection attempts value to 2.
   • DConfigure a Lambda@Edge function to monitor incoming requests for an origin response. Reroute incoming requests if no response is received from the primary origin within 10 seconds.

   Show answer

   Answer: C

   Next question

9. Question 189 · 294 in bank

   AnyCompany deploys and manages networking resources in its AWS network account, named Account-A. AnyCompany acquires Example Corp, which has an application that runs behind an Application Load Balancer (ALB) in Example Corp's AWS account, named Account-B. Example Corp needs to use AWS Global Accelerator to create an accelerator to publish the application to users. AnyCompany's networking team will manage the accelerator. Which solution will meet these requirements with the LEAST management overhead?

   • ACreate an accelerator in Account-В. Use a cross-account role from Account-A to grant the networking team access to manage the accelerator.
   • BDeploy a Network Load Balancer (NLB) in Account-A to route traffic to the ALB in Account-В. Create an accelerator, and set the NLB as the endpoint in Account-A.
   • CCreate a cross-account Global Accelerator attachment in Account-В for the Account-A principal. Create an accelerator in Account-A by using the shared attachment.
   • DCreate an accelerator in Account-A. Use AWS Resource Access Management (AWS RAM) to share the accelerator with Account-В. Associate the ALB in Account-В with the accelerator in Account-A.

   Show answer

   Answer: D

   Next question

10. Question 190 · 294 in bank

    A company wants to improve visibility into its AWS environment. The AWS environment consists of multiple VPCs that are connected to a transit gateway. The transit gateway connects to an on-premises data center through an AWS Direct Connect gateway and a pair of redundant Direct Connect connections that use transit VIFs. The company must receive notification each time a new route is advertised to AWS from on premises over Direct Connect. What should a network engineer do to meet these requirements?

    • AEnable Amazon CloudWatch metrics on Direct Connect to track the received routes. Configure a CloudWatch alarm to send notifications when routes change.
    • BOnboard Transit Gateway Network Manager to Amazon CloudWatch Logs Insights. Use Amazon EventBridge (Amazon CloudWatch Events) to send notifications when routes change.
    • CConfigure an AWS Lambda function to periodically check the routes on the Direct Connect gateway and to send notifications when routes change.
    • DEnable Amazon CloudWatch Logs on the transit VIFs to track the received routes. Create a metric filter Set an alarm on the filter to send notifications when routes change.

    Show answer

    Answer: B

    Explanation

    B - correct Transit Gateway Network Manager provides a centralized view of global networks built on AWS Transit Gateway. It also provides the capability to monitor the routing tables associated with the transit gateway, and then forward routing information to CloudWatch Logs Insights. Once in CloudWatch Logs Insights, you can use EventBridge rules to trigger notifications based on routing changes. This will allow the company to receive notifications each time a new route is advertised to AWS from on-premises over Direct Connect, which meets the requirements. The other options either do not provide the necessary functionality or would not be the most efficient solution for this scenario.

    Source: Adapted from community discussion — zaazanuna

    References

    • AWS documentation
    • AWS documentation
    • AWS documentation

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

ANS-C01 practice, question 181. 294 questions available.